Privacy Policy

1. Who we are

Audit Workspace is provided by [company legal name], [registered address], [registration number] ("we", "us"). You can contact us about this policy or your personal data at support@audit-workspace.com.

This policy covers the public website at audit-workspace.com and the Audit Workspace application. For the personal data that audit firms hold in the application about their own people and their clients, the firm is the controller and we process it on the firm’s behalf, under the data processing agreement in our Terms of Service.

2. What the website collects

The website has no sign-in, sets no cookies of its own and uses no analytics, advertising or tracking scripts.

When you use the Contact or Request a demo form, we collect what you type into it:

• Contact form: your name, email address, firm (optional), the topic and your message.
• Request a demo: your name, work email, firm, job title (optional), the size of your audit team, your country, the areas you would like to see (optional) and any message.

3. How we use enquiries

We use the details you send only to reply to you and, for a demo request, to arrange and follow up the demonstration. We do not add you to a mailing list or share your details with anyone else for their own purposes.

Your enquiry is sent by email to our support inbox through our email provider. It is not stored in the application’s database. To protect the form from abuse, the server briefly counts submissions per visitor using a one-way hash of the IP address, held in memory only; the IP address itself is not recorded by the form.

Our hosting provider keeps standard request logs (such as IP address, time and page requested) for operating and securing the service.

We keep enquiry emails for [retention period], then delete them.

4. What the application processes

If your firm gives you access to Audit Workspace, the application processes:

• Your account: your name, email address, firm role and grade, and your sign-in details. Passwords are handled by our sign-in provider and are never visible to us or to your firm.
• Sign-in cookies, which keep you signed in and are needed for the application to work, and a cookie that remembers the colour theme you chose.
• What you record in the audit files your firm gives you access to, including sign-offs, review notes, uploaded evidence, and an activity log of changes.
• Error reports, when something goes wrong: the error message, technical details, the page path, and your firm and user ids. Never the content of an audit file.
• A log of the emails the application sends (the kind of email, the number of recipients and whether it was sent), without email addresses or content.

5. Who processes data for us

We use these service providers: Supabase (database, file storage and sign-in), Vercel (hosting of the website and application), our email delivery provider (sending enquiries, invitations and notifications) and, where enabled, an error-tracking service.

Some of these providers may process data outside your country. Where that is a cross-border transfer under the applicable data protection law, we rely on the safeguards that law requires. [Details of transfer safeguards to be completed.]

6. Your rights

Under the applicable data protection law, including the Kenya Data Protection Act, 2019 where it applies, you may ask to access, correct or delete your personal data, object to or restrict its processing, and complain to the relevant data protection authority.

For an enquiry you sent through the website, write to support@audit-workspace.com. For data held in your firm’s audit files, contact your firm first: it decides how that data is used, and we will help it respond.

7. Security

The website and application are served over HTTPS. In the application, each firm’s data is kept apart by row-level security in the database, each engagement is visible only to its team, and two-step sign-in is available to every user. No system is completely secure, and we will tell affected firms without undue delay if a personal data breach affects their data, as the data processing agreement sets out.

8. Changes to this policy

We will post any change to this policy on this page with a new version and date.